Data Staged to File (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. This use case looks for common output commands followed by a potential file extension

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1074.001` Data Staged: Local Data Staging

References

https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '5691.18072'
title: Data Staged to File
description: 'Adversaries may stage collected data in a central location or directory
  on the local system prior to Exfiltration. Data may be kept in separate files or
  combined into one file through techniques such as Archive Collected Data. This use
  case looks for common output commands followed by a potential file extension. --
  Threat Actor Association: Actinium/Gamaredon/Primitive Bear, APT29/Nobelium, APT37,
  Arid Viper/APT C-23, Gorgon Group, Kimsuky, Memento Team, Wizard Spider, WIRTE --
  Software Association: Bazar, Conti, Remcos - #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<")
  (">" OR ">>" OR "Out-File") | regex process="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}"
  | table _time, host, user signature_id, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- collection:data staged:local data staging
technique_id:
- T1074.001
data_category:
- Windows Sysmon
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` ("EventCode=1" OR "<EventID>1<") (">" OR ">>" OR "Out-File")

Stage 2: `regex`

| regex process="(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}"

Stage 3: `table`

| table _time, host, user signature_id, process, process_*, parent_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`process`	regex_match	`"(?i)\s(\>(\>)?\|Out\-File)\s.{1,}.\w{2,5}"`	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"EventCode=1"`
1	`"<EventID>1<"`
1	`">"`
1	`">>"`
1	`"Out-File"`